The present invention relates to a method, system, and computer program product for detecting computer malwares that scans network traffic at the protocol level.
As the popularity of the Internet has grown, the proliferation of computer malware has become more common. A typical computer malware is a program or piece of code that is loaded onto a computer and/or performs some undesired actions on a computer without the knowledge or consent of the computer operator. The most widespread, well-known and dangerous type of computer malware are computer viruses, that is, programs or pieces of code that replicate themselves and load themselves onto other connected computers. Once the virus has been loaded onto the computer, it is activated and may proliferate further and/or damage the computer or other computers.
Along with the proliferation of computer viruses and other malware has come a proliferation of software to detect and remove such viruses and other malware. This software is generically known as anti-virus software or programs. In order to detect a virus or other malicious program, an anti-virus program typically scans files stored on disk in a computer system and/or data that is being transferred or downloaded to a computer system, or that is being accessed on a computer system, and compares the data being scanned with profiles that identify various kinds of malware. The anti-virus program may then take corrective action, such as notifying a user or administrator of the computer system of the virus, isolating the file or data, deleting the file or data, etc.
Typically, anti-virus programs scan data that is being transferred or downloaded to a computer system for computer malwares at the operating system level. In other words, the data is scanned after the data is output from the communications protocols and drivers and is available to application programs running on the computer system. While this level of scanning is adequate to detect many of the malwares in existence, operating system level scanning may not successfully block the spread of all malwares. For example, the well-known xe2x80x9cNimbdaxe2x80x9d and xe2x80x9cCodeRedxe2x80x9d malwares may have already replicated themselves by the time they are detected by an operating system level scan.
A need arises for a technique by which malware scanning of data that is being transferred or downloaded to a computer system can be performed so as to block the spread of malwares that may not be blocked by operating system level scanning.
The present invention is a method, system, and computer program product for malware scanning of data that is being transferred or downloaded to a computer system that is performed at the protocol level. The present invention is capable of blocking the spread of malwares that may not be blocked by operating system level scanning. In one embodiment of the present invention, a method of detecting a malware comprises the steps of: a) receiving a data stream, b) scanning the data stream at a protocol level to detect a malware, c) removing the detected malware from the data stream, and d) transmitting the data stream without the malware. The data stream may be received from a communications network. The communications network may be the Internet. The protocol level may include a protocol including at least one of: Post Office Protocol, HyperText Transfer Protocol, File Transfer Protocol, Trivial File Transfer Protocol, Simple Mail Transfer Protocol, Internet Message Access Protocol, or Network News Transfer Protocol.
In one aspect of the present invention, steps a)-d) are performed on a workstation computer system. The receiving step may comprise the step of receiving a data stream from a local area network or a wide area network connected to the workstation computer system. The transmitting step may comprise the step of transmitting the data stream without the malware to an operating system and/or application programs running on the workstation computer system. The protocol level may includes a protocol including at least one of Post Office Protocol, HyperText Transfer Protocol, File Transfer Protocol, Trivial File Transfer Protocol, Simple Mail Transfer Protocol, Internet Message Access Protocol, or Network News Transfer Protocol.
In one aspect of the present invention, steps a)-d) are performed on a gateway computer system. The receiving step may comprise the step of receiving a data stream from a network to the gateway computer system or from a network via a router/firewall connected to the gateway computer system. The transmitting step may comprise the step of transmitting the data stream without the malware to a computer system via a local area network or a wide area network connected to the gateway computer system. The protocol level may include a protocol including at least one of Post Office Protocol, HyperText Transfer Protocol, File Transfer Protocol, Trivial File Transfer Protocol, Simple Mail Transfer Protocol, Internet Message Access Protocol, or Network News Transfer Protocol.